Horizon Alert
Summary of the vulnerability and why it matters
Sophos XG Firewall versions prior to v17.5 MR12 contain a buffer overflow vulnerability within the HTTP/S Bookmarks feature. This flaw could permit attackers to execute arbitrary code remotely. The potential impact includes unauthorized system access and compromise of data integrity and confidentiality, affecting the organization's operational security and data protection.
- Vulnerable: Sophos XG Firewall HTTP/S Bookmarks
- Flaw: Buffer overflow allows remote code execution
- Impact: Unauthorized access, data compromise
Attack Path
How an attacker could exploit the issue
A network-accessible feature on Sophos XG Firewalls could be exploited by attackers. This exploit allows for remote code execution through a buffer overflow vulnerability. Successful exploitation could grant attackers control over affected systems.
- Exposed HTTP/S Bookmarks feature.
- Unauthenticated attackers gain access.
- Trigger overflow for remote execution.
Live Threat
Current exploitation, exposure, and threat context
This critical vulnerability allows for remote code execution, enabling attackers to potentially gain complete control over Sophos XG Firewall devices. The exploit requires no authentication and has low complexity, making it accessible to a wide range of attackers. Its presence on CISA's Known Exploited Vulnerabilities catalog indicates active exploitation in the wild.
- Likely attacker skill: Basic to advanced.
- Required access: Network access to the User Portal.
- Business risk: Critical; immediate action required.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Organizations should address this critical vulnerability affecting Sophos XG Firewall to prevent potential remote code execution and data compromise. The vulnerability exists within the HTTP/S Bookmarks feature for clientless access, which is exposed to the network. Swift action is required to identify and remediate affected systems, thereby mitigating business risk and protecting sensitive data.
- Find exposed Sophos XG Firewalls.
- Restrict access to the affected feature.
- Apply the vendor's hotfix.
- Verify the fix was applied.
- Monitor for related activity.
